security issues from nocrypto repository

[hannesm]

• Implement RSA-CRT hardening mirleft/ocaml-nocrypto#81 (RSA-CRT) see apply RSA-CRT hardening for PKCS1 sign operations; use eqaf for comparing cstructs in constant time #15
• CCM mode computes incorrect tag with empty AAD mirleft/ocaml-nocrypto#166 (CCM mode computes incorrect tag with empty AAD), see ccm gcm adjustments #18
• CCM mode: assertion failure when a short nonce is used mirleft/ocaml-nocrypto#167 (CCM mode: assertion failure when a short nonce is used), see ccm gcm adjustments #18
• CCM mode: decrypting an empty ciphertext fails mirleft/ocaml-nocrypto#168 (CCM mode: decrypting an empty ciphertext fails), see ccm gcm adjustments #18
• GCM allows the empty IV, which is dangerous mirleft/ocaml-nocrypto#169 (GCM allows the empty IV, which is dangerous), see ccm gcm adjustments #18
• use mpz_powm_sec instead of mpz_powm, see mitigate timing side-channels in public key cryptography: use powm_sec instead of powm #24
• constant time equality (use eqaf), see apply RSA-CRT hardening for PKCS1 sign operations; use eqaf for comparing cstructs in constant time #15
• rdrand/rdseed return value (<> 1 -> RNG not ready) and ryzen 3000 bug (always returning -1) see entropy adjustments: check return value of rdrand/rdseed (and retry up to 10 times), cope with AMD ryzen 3000 bug #17

[hannesm]

closing this issue, the leftover item is now discussed in more lenght in #24